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(U) QUERYING PROCEDURES USED IN CONNECTION WITH ^(OT21?I?fQWS28 
3F FOREIGN INTELLIGENCE INFORMATION PURSUANT TO SECTION 702 OF 
THE FOREIGN INTELLIGENCE SURVEILLANCE ACT OF 1957J8 



(U) I. These procedures apply to the querying of unminimized information, acquired pursuant 
to section 702 of the Foreign Intelligence Surveillance Act of 1978, as amended (“FISA” or “the 
Act”), by the National Security Agency (“NSA”), Federal Bureau of Investigation (“FBI”), 
Central Intelligence Agency (“CIA”), and National Counterterrorism Center (“NCTC”) 
(collectively, “covered agencies”), and apply in addition to separate minimization procedures for 
the covered agencies adopted pursuant to subsection 702(e) of the Act. These querying 
procedures should be read and applied in conjunction with those minimization procedures, and 
nothing in these procedures permits any actions that would otherwise be prohibited by those 
minimization procedures. Authorized users with access to unminimized section 702-acquired 
information should process the results of an appropriate query of unminimized section 702- 
acquired information in accordance with their covered agency’s applicable section 702 
minimization procedures. 

(U) II. If a covered agency determines that it must take action in apparent departure from these 
querying procedures to protect against an immediate threat to human life (e.g., force protection 
or hostage situations) and that it is not feasible to obtain a timely modification of these 
procedures, such agency may take such action immediately. That agency will make a record of 
the action taken, to include any query term(s) used, and report the action taken to the Office of 
the Director of National Intelligence (“ODNI”) and to the Department of Justice’s National 
Security Division (“NSD”), which will promptly notify the Foreign Intelligence Surveillance 
Court (“FISC”) of such activity. 

(U) III. Nothing in these procedures shall restrict the lawful oversight functions of NSD or 
ODNI, or the applicable Offices of the Inspectors General, or restrict a covered agency from 
providing the assistance necessary for these entities to perform their lawful oversight functions. 
Nothing in these procedures shall restrict a covered agency’s performance of lawful training 
functions of its personnel, or creating, testing, or maintaining its systems. In addition, nothing in 
these procedures shall restrict a covered agency’s performance of lawful oversight functions of 
its personnel or systems, which includes queries performed for the following reasons: in support 
of a covered agency’s investigation and remediation of a possible compliance incident, including 
a potential spill of classified information; to identify information subject to destruction, including 
under a covered agency’s minimization procedures; to ensure the effective application of 
marking or segregation requirements in relevant agency minimization procedures or federal 
records requirements; in support of a covered agency’s audit or review, for quality control 
purposes, of work done by agency personnel; in support of authorized work conducted in 
systems used solely for audits and oversight; or in support of agency investigations of potential 
misconduct by an employee that otherwise would not meet the query standards detailed for each 
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agency below. Should a covered agency intend to rely on the provision regarding lawful 
oversight functions of its personnel or systems, in whole or in part, to deviate from an aspect of 
these procedures and the purpose of such deviation is not listed above, the covered agency shall 
consult with NSD and ODNI prior to conducting such a query. NSD shall then report the 
deviation promptly to the FISC. Each such report shall describe the nature of the deviation from 
the procedures and identify the specific oversight activity for which the deviation was necessary. 
Similarly, nothing in these procedures shall prohibit the querying of information necessary to 
comply with a specific congressional mandate or order of a court within the United States. 
Moreover, nothing in these procedures shall prohibit the querying of information necessary to 
comply with the requirements of the Freedom of Information Act (FOIA), 5 U.S.C. § 552, or the 
Privacy Act, 5 U.S.C. § 552a. Additionally, nothing in these procedures shall restrict a covered 
agency’s ability to conduct vulnerability or network assessments using information acquired 
pursuant to section 702 of the Act in order to ensure that its systems are not or have not been 
compromised. Covered agencies are permitted to conduct queries designed to identify 
information that must be produced or preserved in connection with a litigation matter. The 
covered agencies must keep a record of any United States person query term used for a query of 
unminimized section 702-acquired information in support of the activities described in this 
Section. 

(U) IV. The covered agencies must generate and maintain an electronic record of each United 
States person query term used for a query of unminimized information acquired pursuant to 
section 702. Such electronic record must, at a minimum, include the following information: the 
query term(s) used or approved, the date of the query or approval of query term(s), the identifier 
of the user who conducted the query or sought approval of the query term(s), and, in the case of 
NSA content queries, the approving official in NSA’s Office of General Counsel and duration of 
the approval. NSA, CIA, and NCTC shall also maintain records of the statement of facts 
establishing that the use of any United States person query term is reasonably likely to retrieve 
foreign intelligence information. In the event it is impracticable for a covered agency system to 
generate an electronic record, or in the event an unanticipated circumstance arises that prevents 
the generation of such an electronic record, the covered agency must generate and maintain a 
written record of each United States person query term that contains the same information 
required for electronic records, as described above. Before conducting a query in a system that 
does not generate an electronic record of a query, the covered agency personnel must reasonably 
determine that conducting that query in a system that generates an electronic record would be 
insufficient for technical, analytical, operational, or security reasons. For NSA content queries, 
such records of United States person query terms must be maintained at least five years from the 
date a United States person query term was approved; for NSA metadata queries and for queries 
conducted by the FBI, CIA, and NCTC, such records of United States person query terms must 
be maintained at least five years from the date a United States person query term was used. 


SECRET//NOFQRN 


DATE: Ocl 8, 2019 - Authorized Public Release 


2 

Page 2 of 7 


Consolidated Set Section 702 Querying Procedures, Mar. 2018 




Document regarding the Section 702 2018 Certification 


-?ir CT1F TJ N fTTOJIN 


ODNI Authorized for Public Release 


(U) V. Definitions and Presumptions 

(U) A. Definitions for purposes of these procedures 


(U) These procedures adopt the definitions set forth in 50 U.S.C. § 1801 for the terms 
“foreign intelligence information,” “person,” “United States,” and “United States person.” 

^^-When used to conduct a query, “United States person query term” means a term that is 
reasonably likely to identify one or more specific United States persons. United States 
person query terms may be either a single item of information or information that, when 
combined with other information, is reasonably likely to identify one or more specific United 
States persons. Determining whether information is reasonably likely to identify one or more 
specific United States persons in a particular context may require a case-by-case assessment 
by a trained intelligence professional. “United States person query term” is not limited to 
any single category of information or technology. Depending on the context, examples of 
United States person query terms may include: names or 

jxsodate^ersonal or corporate identification numbersj 

Band street address, telephone, and | _ 

umte^tates person query term does not incluae a reierence io a prc 
manufacturer’s name (or related nomenclature, including part numbers) or the use of a name 
in a descriptive sense, as, for example, “Ford Crown Victoria” or “Boeing 737,” so long as 
such term is not intended to retrieve information concerning a specific United States person 
(e.g., “Ford Crown Victoria with License Plate Number CBA 321”). 



(U) “Query” means the use of one or more terms 1 to retrieve the unminimized contents or 
noncontents (including metadata) of section 702-acquired information that is located in a 
covered agency’s system. The term “query” does not include a user’s query of a system that 
contains unminimized section 702-acquired information, where the user does not receive 
unminimized section 702-acquired information in response to the query either because the 
user has not been granted access to the unminimized section 702-acquired information, or 
because a user who has been granted such access has limited the query such that it cannot 
retrieve unminimized section 702-acquired information. The term “query” also does not 
include (1) a system user’s actions subsequent to conducting a query for purposes of sorting 
the results of that query based upon the attributes of the information retrieved, 2 or (2) 
examining or manipulating, including by technical means, communications or documents for 
the purpose of minimizing such communications or documents. 3 



2 (U) For example, the action of a system user to sort the results of a query (i.e., the information actually 
returned to a system user from a query) by date, time, etc. 


3 (U) For example, an analyst might run a script against a spreadsheet that would find and replace all 
instances of a known United States person’s name with a generic term, such a “U.S. Person 1.” 
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(U) “Contents” means any information concerning the substance, purport, or meaning of a 
communication. 

(U) “Metadata” means the dialing, routing, addressing, or signaling information associated 
with a communication, but does not include information concerning the substance, purport, 
or meaning of the communication. 

(U) The terms “National Security Agency” and “NSA personnel” refer to any employees of 
the National Security Agency/Central Security Service (“NSA/CSS” or “NSA”) and any 
other personnel engaged in Signals Intelligence (SIGINT) operations authorized pursuant to 
section 702 of the Act if such operations are executed under the direction, authority, or 
control of the Director, NSA/Chief, CSS (DIRNSA). 

(U) The terms “Federal Bureau of Investigation” and “FBI personnel” refer to any 
employees of the FBI, as well as all contractors and others authorized to work under the 
direction and control of the FBI. 

(U) The terms “Central Intelligence Agency,” “CIA,” and “CIA personnel” refer to any 
employees of CIA and any other personnel acting under the direction, authority, or control of 
the Director of the CIA, as well as to employees of other U.S. Government agencies who are 
physically located at CIA and who are granted access to CIA systems to perform duties in 
support of CIA operations, but who retain the authorities and responsibilities of their parent 
organization. 

(U) “NCTC employee” means (i) individuals directly employed by NCTC, (ii) personnel 
detailed to NCTC from other departments or agencies who work under NCTC management 
and supervision in a manner substantially the same as individuals directly employed by 
NCTC, and (iii) contractors working under NCTC management and supervision who are 
authorized to perform services in support of NCTC on FISA-related matters. 

(U) B. Presumptions for purposes of these procedures 

(U) The following guidelines apply in determining whether a person whose status is 
unknown is a United States person: 

(1) (U) A person known to be currently in the United States will be treated as a United 
States person unless positively identified as an alien who has not been admitted for 
permanent residence, or unless the nature or circumstances of the person’s 
communications give rise to a reasonable belief that such person is not a United 
States person. 

(2) (U) A person known to be currently outside the United States, or whose location is 
unknown, will not be treated as a United States person unless such person can be 
positively identified as such, or the nature or circumstances of the person’s 
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communications give rise to a reasonable belief that such person is a United States 
person. 

(3) (U) A person who at any time has been known to have been an alien admitted for 
lawful permanent residence is treated as a United States person, unless a 
determination that such person is no longer a United States person is made in 
consultation with the covered agency’s Office of General Counsel or equivalent. 

(4) (U) An unincorporated association whose headquarters or primary office is located 
outside the United States is presumed not to be a United States person unless there is 
information indicating that a substantial number of its members are citizens of the 
United States or aliens lawfully admitted for permanent residence. 

(U) VI. Querying Procedures for the National Security Agency (NSA) 

(U) NSA personnel who have received training in these procedures and NSA’s section 702 
minimization procedures may query NSA systems containing unminimized information 
acquired in accordance with section 702 of the Act. Except as provided above in Sections II 
and III, such queries must be reasonably likely to retrieve foreign intelligence information, as 
defined by FISA. Any United States person query term used to identify and select 
unminimized section 702-acquired content must first be approved by NSA’s Office of 
General Counsel. NSA personnel seeking such an approval must provide a statement of facts 
establishing that the use of any such identifier as a selection term is reasonably likely to 
retrieve foreign intelligence information, as defined by FISA. NSA may approve the use of a 
United States query term to query unminimized section 702-acquired content for no longer 
than a period of one year. As provided in Section IV above, NSA will maintain records of all 
United States person query terms approved for use as selection terms, including the identifier 
of the approving official in NSA’s Office of General Counsel, the duration of such an 
approval, and the additional information required by Section IV. Any use of a United States 
person query term to query unminimized section 702-acquired metadata must be 
accompanied by a statement of facts showing that the use of any such query term is 
reasonably likely to retrieve foreign intelligence information, as defined by FISA. As 
provided in Section IV above, NSA will maintain records of all such United States person 
query terms and the additional information required by Section IV. Internet transactions, as 
defined in NSA’s section 702 minimization procedures, acquired on or before March 17, 
2017, will be sequestered in NSA systems to prevent NSA analysts from accessing or using 
computer selection terms to scan such transactions until such transactions are destroyed. 

NSA will maintain the above records in a manner that will allow NSD and ODNI to conduct 
oversight and compliance in an effective manner and such records will be maintained for five 
years from either the date of the query for queries of unminimized section 702-acquired 
metadata, or the date of the approval of the U.S. person query term for queries of 
unminimized section 702-acquired content. NSD and ODNI will conduct oversight of 
NSA’s activities with respect to United States persons that are conducted pursuant to these 
procedures. 
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(U) VII. Querying Procedures for the Federal Bureau of Investigation (FBI) 

(U) FBI personnel who have received training in these procedures and FBI’s section 702 
minimization procedures may query FBI systems containing unminimized information 
acquired in accordance with section 702 of the Act to find, extract, review, translate, and 
assess whether such information reasonably appears to be foreign intelligence information, to 
be necessary to understand foreign intelligence information or assess its importance, or to be 
evidence of a crime. Except as provided above in Sections II and III, such queries must be 
reasonably likely to retrieve foreign intelligence information, or evidence of a crime. 

(U) For queries conducted using United States person query terms that are not designed to 
find and extract foreign intelligence information, as defined by FISA, the FBI will follow the 
procedures in subsection 702(f)(2) of FISA before accessing the contents of communications 
retrieved by such queries in connection with a predicated criminal investigation that does not 
relate to the national security of the United States, unless there is a reasonable belief that 
such contents could assist in mitigating or eliminating a threat to life or serious bodily harm. 
Consistent with subsections 702(f)(2)(F)(ii)-(iii) of the Act, this restriction does not prohibit 
or limit (1) the FBI’s ability to review, without a court order, the results of any query of 
section 702-acquired information that was reasonably designed to find and extract foreign 
intelligence information, regardless of whether such foreign intelligence information could 
also be considered evidence of a crime; and (2) the FBI’s ability to access the results of 
queries that were conducted when evaluating whether to open an assessment or predicated 
investigation related to the national security of the United States. 

(U) As provided in Section IV above, the FBI shall maintain records 4 * 6 of all United States 
person query terms used for five years from the date the United States person query term was 
used in a manner that will allow NSD and ODNI to conduct oversight and compliance in an 
effective manner. NSD and ODNI will review FBI’s queries of unminimized section 702- 
acquired information to ensure that they were reasonably likely to retrieve foreign 
intelligence information or evidence of a crime, or were otherwise conducted pursuant to one 
of the exceptions provided above. 

(U) Except as provided above in Sections II and III, queries of unminimized section 702- 
acquired metadata must be reasonably likely to retrieve foreign intelligence information, or 
evidence of a crime. The FBI shall maintain records of such queries that use United States 
person query terms for five years from the date the United States person query term was 
used. 


4 (U) The FBI intends to satisfy this record-keeping requirement by keeping a record of all queries of 
unminimized information that is acquired by targeting non-United States persons reasonably believed to 
be located outside the United States to acquire foreign intelligence information in accordance with section 
702. 
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(U) VIII. Querying Procedures for the Central Intelligence Agency (CIA) 

(U) CIA personnel who have received training in these procedures and CIA’s section 702 
minimization procedures may query CIA systems containing unminimized information 
acquired in accordance with section 702 of the Act. Except as provided above in Sections II 
and III, such queries must be reasonably likely to retrieve foreign intelligence information, as 
defined by FISA. Any use of a United States person query tenn must be accompanied by a 
statement of facts showing that the use of any such query term is reasonably likely to retrieve 
foreign intelligence information. As provided in Section IV above, CIA will maintain 
records of all such United States person query terms, including the additional information 
required by Section IV, for five years from the date the United States person query term was 
used. CIA will maintain these records in a manner that will allow NSD and ODNI to conduct 
oversight and compliance in an effective manner. NSD and ODNI will review CIA’s queries 
of unminimized section 702-acquired information using any such query terms to ensure that 
they were reasonably likely to retrieve foreign intelligence information, or were otherwise 
conducted pursuant to one of the exceptions provided above. 

(U) IX. Querying Procedures for the National Counterterrorism Center (NCTC) 

(U) NCTC employees who have received training in these procedures and NCTC’s section 
702 minimization procedures may query NCTC systems containing unminimized 
information acquired in accordance with section 702 of the Act. Except as provided above in 
Sections II and III, such queries must be reasonably likely to retrieve foreign intelligence 
information, as defined by FISA. Any use of a United States person query term must be 
accompanied by a statement of facts showing that the use of any such query term is 
reasonably likely to retrieve foreign intelligence information. As provided above in Section 
IV, NCTC will maintain records of all such United States person query terms, including the 
additional information required by Section IV, for five years from the date the United States 
person query term was used. NCTC will maintain these records in a manner that will allow 
NSD and ODNI to conduct oversight and compliance in an effective manner. NSD and 
ODNI will review NCTC’s queries of unminimized section 702-acquired information using 
any such query terms to ensure that they were reasonably likely to retrieve foreign 
intelligence information, or were otherwise conducted pursuant to one of the exceptions 
provided above. 
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